💼 Management Samenvatting
Schakel in Junk Mail UI in Outlook geeft users zichtbaarheid en controle over junk email filtering voor phishing awareness en false positive correction.
Aanbeveling
Verifieer ingeschakeld
Risico zonder
Low
Risk Score
3/10
Implementatie
1u (tech: 0.5u)
Van toepassing op:
✓ Microsoft Outlook
Junk Mail UI: Users kunnen emails markeren als junk/not junk, Phishing awareness (see junk folder), False positive correction (move van junk). Zonder UI: Users blind to junk filtering, No false positive fix (legitimate emails lost), No phishing training opportunity.
Implementatie
Schakel in Junk Mail UI: Right-click → Junk menu visible, gebruikers kunnen report phishing, Junk folder accessible.
Vereisten
Outlook 2016+ (Standaard ingeschakeld)
Implementatie
Verify: Junk Mail UI Standaard ingeschakeld. Intune Settings Catalog: Outlook\Security → Junk E-mail UI: ingeschakeld.
Compliance en Auditing
Security awareness: User training opportunity via junk folder review.
Monitoring
Gebruik PowerShell-script junk-mail-ui-visible.ps1 (functie Invoke-Monitoring) – Controleren.
Remediatie
Gebruik PowerShell-script junk-mail-ui-visible.ps1 (functie Invoke-Remediation) – Herstellen.
Compliance & Frameworks
- BIO: 05.01.01 - Information security controls
Automation
Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).
PowerShell
# Control: O365-OU-000006 - junk mail ui visible
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3
param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\OUTLOOK\Security",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
function Invoke-Monitoring {
Write-Host "Monitoring O365-OU-000006: junk mail ui visible" -ForegroundColor Green
try {
$valueName = "junkmailuivisible"
$expectedValue = 1
if (-not (Test-Path $RegistryPath)) {
Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
return $false
}
$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "✓ Control compliant: $valueName = $expectedValue" -ForegroundColor Green
return $true
}
else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "✗ Control non-compliant: $valueName = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
return $false
}
}
catch {
Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return $false
}
}
function Invoke-Remediation {
Write-Host "Remediating O365-OU-000006: junk mail ui visible" -ForegroundColor Yellow
try {
if ($WhatIf) {
Write-Host " [WhatIf] Would set registry value" -ForegroundColor Cyan
return $true
}
if (-not (Test-Path $RegistryPath)) {
New-Item -Path $RegistryPath -Force | Out-Null
Write-Host " Created registry path: $RegistryPath" -ForegroundColor Green
}
$valueName = "junkmailuivisible"
$expectedValue = 1
Set-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host " Set $valueName to $expectedValue" -ForegroundColor Green
Start-Sleep -Seconds 1
return Invoke-Monitoring
}
catch {
Write-Host " Error during remediation: $_" -ForegroundColor Red
return $false
}
}
function Invoke-Revert {
Write-Host "Reverting O365-OU-000006: junk mail ui visible" -ForegroundColor Yellow
try {
if ($WhatIf) {
Write-Host " [WhatIf] Would remove registry value" -ForegroundColor Cyan
return $true
}
$valueName = "junkmailuivisible"
if (Test-Path $RegistryPath) {
Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
Write-Host " Removed registry value: $valueName" -ForegroundColor Green
}
return $true
}
catch {
Write-Host " Error during revert: $_" -ForegroundColor Red
return $false
}
}
# Main execution
try {
if ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Revert) {
$result = Invoke-Revert
exit $(if ($result) { 0 } else { 1 })
}
else {
Write-Host "Usage: [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow
}
}
catch {
Write-Host "Script execution error: $_" -ForegroundColor Red
exit 1
}
Risico zonder implementatie
Risico zonder implementatie
Low: Low: Users kan niet fix false positives of report Phishing aanvallen.
Management Samenvatting
Schakel in Junk Mail UI. User regelen over spam filtering. Standaard ingeschakeld. Verify: 30 min.
- Implementatietijd: 1 uur
- FTE required: 0.01 FTE